The 'fastify-bundler' npm package (version 1.4.13) exports a function that fetches JSON data from a remote URL and executes the 'data.credits' field as JavaScript code using the Function constructor with Node.js globals bound. This allows an attacker to run arbitrary code with full privileges on the host system. The package's dependencies include modules for decrypting Windows credentials, accessing browser login data, host fingerprinting, and network communication, which can be leveraged for credential theft and command-and-control. The package uses deceptive naming and README content to mislead users into installing it, targeting multiple popular ecosystems.

Systems with 'fastify-bundler' version 1.4.13 installed are fully compromised due to remote code execution with full Node.js privileges. Attackers can execute arbitrary code, steal credentials, perform host fingerprinting, and establish command-and-control channels. All secrets and keys on affected systems should be considered compromised and rotated immediately. Removal of the package does not guarantee full remediation as the attacker may have installed additional malicious software.

Remove the 'fastify-bundler' package immediately from all affected systems. Rotate all secrets, credentials, and keys from a secure, uncompromised environment. Because the attacker may have persistent access beyond the package, conduct a thorough investigation and remediation of the affected systems. No official patch or fix is available; the package itself is malicious. Avoid installing packages with suspicious or inconsistent metadata.